I don't have a strong opinion on this. For sure, we shouldn't accept
external depencies blindly. I'm just unsure whether we should put a
hard rule or not.
On the other hand, there could also be non-odoo python dependencies,
and for those I would not try to restrict them. In my opinion odoo is
already very isolated from the outside python world, so if someone
finds a python package on pypi and wants to depend on it for an OCA
module, it's OK by me.